General

Malware Config

Signatures

Files

• 04ad2ffc0bb8cf52af9e6977d56ceab2_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Code Sign

  71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  17-11-2006 00:00

  Not After

  16-07-2036 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  3d:ec:b3:f6:06:98:17:01:01:07:78:2e:ab:f5:18:fb

  Certificate

  Issuer

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Not Before

  27-11-2014 00:00

  Not After

  23-02-2016 23:59

  Subject

  CN=Bandoo Media\, Inc.,O=Bandoo Media\, Inc.,L=Panama City,ST=Panama,C=PA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 458KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 5.7MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 37KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/Ask_Logo.bmp
• $PLUGINSDIR/InvokeShellVerb.dll

  .dll windows:4 windows x86 arch:x86

  1dd17c8be9b0761e58bbdf6fc06463e3

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  msvcrt

  _wtoi

  wcscmp

  kernel32

  lstrcpynW

  lstrcpyW

  FreeLibrary

  LoadLibraryW

  GlobalFree

  GlobalAlloc

  user32

  LoadStringW

  ole32

  CoInitialize

  CoUninitialize

  CoCreateInstance

  CoFreeUnusedLibraries

  oleaut32

  SysFreeString

  Exports

  Exports

  DoIt

  Sections

  .text

  Size: 1024B - Virtual size: 804B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 635B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 212B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 124B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/MoreInfo.dll

  .dll windows:4 windows x86 arch:x86

  149adf074d317fbf0d2f17314bd18969

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

  Imports

  user32

  wsprintfW

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  kernel32

  lstrlenW

  lstrcpyW

  lstrcpynW

  lstrcatW

  GlobalAlloc

  GetSystemDirectoryW

  GlobalFree

  Exports

  Exports

  GetComments

  GetCompanyName

  GetFileDescription

  GetFileVersion

  GetInternalName

  GetLegalCopyright

  GetLegalTrademarks

  GetOSUserinterfaceLanguage

  GetOriginalFilename

  GetPrivateBuild

  GetProductName

  GetProductVersion

  GetSpecialBuild

  GetUserDefined

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 44B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 188B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/System.dll

  .dll windows:5 windows x86 arch:x86

  039bcbc605477e8e87ec550c2e60e748

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  GlobalSize

  GetLastError

  lstrcpyW

  lstrcpynW

  GetProcAddress

  WideCharToMultiByte

  lstrcatW

  lstrlenW

  lstrcmpiW

  LoadLibraryW

  GetModuleHandleW

  MultiByteToWideChar

  VirtualAlloc

  VirtualProtect

  FreeLibrary

  user32

  wsprintfW

  ole32

  CLSIDFromString

  StringFromGUID2

  Exports

  Exports

  Alloc

  Call

  Copy

  Free

  Get

  Int64Op

  Store

  StrAlloc

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 963B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/UAC.dll

  .dll windows:4 windows x86 arch:x86

  c4a726be6ec458c19b16bf3893cf4bc1

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SetLastError

  lstrcmpiW

  GetCurrentThreadId

  GetProcAddress

  GetCommandLineW

  UnmapViewOfFile

  WaitForSingleObject

  GetCurrentProcessId

  SetEvent

  GetVersionExW

  SetCurrentDirectoryW

  MapViewOfFile

  Sleep

  OpenProcess

  GetExitCodeProcess

  GetExitCodeThread

  CreateThread

  CreateFileMappingW

  CreateEventW

  lstrlenW

  GlobalAlloc

  CreateProcessW

  GetLastError

  FormatMessageW

  LocalFree

  GlobalFree

  CloseHandle

  GetModuleFileNameW

  lstrcatW

  GetPrivateProfileIntW

  GetPrivateProfileStringW

  DuplicateHandle

  LoadLibraryA

  user32

  SetWindowsHookExW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  PeekMessageW

  MsgWaitForMultipleObjects

  DefWindowProcW

  PostMessageW

  SetForegroundWindow

  CreateWindowExW

  GetWindowThreadProcessId

  CallWindowProcW

  SetWindowPos

  GetWindowRect

  UnhookWindowsHookEx

  GetClassNameW

  CallNextHookEx

  CharNextW

  DialogBoxParamW

  MessageBoxW

  EndDialog

  SetWindowLongW

  LoadImageW

  GetWindowLongW

  EnableWindow

  ShowWindow

  wsprintfW

  LoadStringW

  GetDlgItem

  SendMessageW

  DestroyWindow

  advapi32

  GetUserNameW

  QueryServiceStatus

  CloseServiceHandle

  OpenServiceW

  OpenSCManagerW

  LookupPrivilegeValueW

  GetTokenInformation

  FreeSid

  EqualSid

  AllocateAndInitializeSid

  OpenThreadToken

  AdjustTokenPrivileges

  OpenProcessToken

  shell32

  ShellExecuteExW

  ole32

  CoInitialize

  Exports

  Exports

  _

  Sections

  .text

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 892B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/UserInfo.dll

  .dll windows:5 windows x86 arch:x86

  45d25ca52c312b2254c60dbcb30342d1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetVersion

  GetCurrentThread

  GetCurrentProcess

  GetModuleHandleW

  GetProcAddress

  GetLastError

  GlobalFree

  CloseHandle

  lstrcpynW

  GlobalAlloc

  advapi32

  OpenProcessToken

  GetTokenInformation

  AllocateAndInitializeSid

  EqualSid

  FreeSid

  GetUserNameW

  OpenThreadToken

  Exports

  Exports

  GetAccountType

  GetName

  GetOriginalAccountType

  Sections

  .text

  Size: 1024B - Virtual size: 686B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 753B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 240B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/ask_eula.rtf

  .rtf
• $PLUGINSDIR/banner.bmp
• $PLUGINSDIR/banner_chrome.bmp
• $PLUGINSDIR/banner_chrome_36.bmp
• $PLUGINSDIR/banner_ff.bmp
• $PLUGINSDIR/banner_ie.bmp
• $PLUGINSDIR/modern-header.bmp
• $PLUGINSDIR/nsArray.dll

  .dll windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Exports

  Exports

  Clear

  Get

  Join

  Length

  Remove

  RemoveList

  Set

  SetList

  Sort

  Split

  Sections

  UPX0

  Size: - Virtual size: 28KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .dll windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 503B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 280B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 864B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsDialogs.dll

  .dll windows:5 windows x86 arch:x86

  9ea5bdc8c90dfcffe309465c26c89758

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  MulDiv

  lstrlenW

  HeapFree

  GetProcessHeap

  lstrcmpiW

  HeapReAlloc

  lstrcpynW

  GetFileAttributesW

  lstrcpyW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  HeapAlloc

  GlobalFree

  user32

  LoadCursorW

  RemovePropW

  DrawFocusRect

  GetPropW

  DrawTextW

  GetWindowTextW

  GetDlgItem

  SetWindowLongW

  SetWindowPos

  CreateDialogParamW

  MapWindowPoints

  GetWindowRect

  SetCursor

  CreateWindowExW

  IsWindow

  SetTimer

  KillTimer

  DispatchMessageW

  TranslateMessage

  GetMessageW

  IsDialogMessageW

  ShowWindow

  wsprintfW

  GetClientRect

  CharPrevW

  CallWindowProcW

  SetPropW

  DestroyWindow

  MapDialogRect

  CharNextW

  SendMessageW

  GetWindowLongW

  gdi32

  SetTextColor

  shell32

  SHGetPathFromIDListW

  SHBrowseForFolderW

  comdlg32

  GetSaveFileNameW

  CommDlgExtendedError

  GetOpenFileNameW

  ole32

  CoTaskMemFree

  Exports

  Exports

  Create

  CreateControl

  CreateItem

  CreateTimer

  GetUserData

  KillTimer

  OnBack

  OnChange

  OnClick

  OnNotify

  SelectFileDialog

  SelectFolderDialog

  SetRTL

  SetUserData

  Show

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 152B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 590B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsExec.dll

  .dll windows:5 windows x86 arch:x86

  8700d0ebbb41c81ea52718af1ab70a93

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcpyW

  MultiByteToWideChar

  lstrlenA

  lstrcmpiW

  lstrlenW

  ExitProcess

  CloseHandle

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessW

  lstrcpynW

  GetCommandLineW

  Sleep

  TerminateProcess

  GlobalReAlloc

  GlobalUnlock

  GlobalSize

  ReadFile

  GetModuleHandleW

  GetTickCount

  GetStartupInfoW

  CreatePipe

  GetVersionExW

  GlobalLock

  DeleteFileW

  lstrcatW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  CreateFileW

  CopyFileW

  GetTempFileNameW

  GlobalFree

  GlobalAlloc

  GetModuleFileNameW

  GetProcAddress

  PeekNamedPipe

  GetCurrentProcess

  user32

  CharPrevW

  CharNextW

  SendMessageW

  FindWindowExW

  wsprintfW

  advapi32

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  Exports

  Exports

  Exec

  ExecToLog

  ExecToStack

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 454B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsisXML.dll

  .dll windows:4 windows x86 arch:x86

  1156b4dd8fa8f1d42696b7a2d5b3e139

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcpyW

  InterlockedIncrement

  GlobalFree

  GetLastError

  MultiByteToWideChar

  lstrlenA

  InterlockedDecrement

  LocalFree

  user32

  wsprintfW

  ole32

  OleRun

  CLSIDFromString

  CLSIDFromProgID

  CoCreateInstance

  CoInitialize

  oleaut32

  VariantCopy

  VariantInit

  SysStringByteLen

  SysAllocStringByteLen

  SysFreeString

  SysAllocString

  VariantClear

  GetErrorInfo

  msvcrt

  free

  _adjust_fdiv

  malloc

  _CxxThrowException

  memcpy

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  __CxxFrameHandler

  _wtoi

  _initterm

  ??1type_info@@UAE@XZ

  Exports

  Exports

  appendChild

  create

  createElement

  createProcessingInstruction

  getAttribute

  getText

  insertBefore

  load

  loadAndValidate

  parentNode

  release

  removeChild

  save

  select

  setAttribute

  setDocumentElement

  setText

  Sections

  .text

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 444B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 642B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/registry.dll

  .dll windows:4 windows x86 arch:x86

  421a02aae559045e04759aae146087eb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CloseHandle

  CreateProcessA

  CreateProcessW

  GlobalAlloc

  SearchPathA

  SearchPathW

  GetFileAttributesA

  GetFileAttributesW

  CreateFileA

  CreateFileW

  WriteFile

  WideCharToMultiByte

  GetWindowsDirectoryW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  GlobalFree

  user32

  FindWindowExA

  SetWindowTextA

  SetWindowTextW

  MessageBoxW

  GetDlgItem

  advapi32

  RegQueryValueExA

  RegQueryValueExW

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyExA

  RegCreateKeyExW

  RegEnumValueA

  RegEnumValueW

  RegEnumKeyExA

  RegEnumKeyExW

  RegCloseKey

  RegSetValueExA

  RegDeleteValueW

  RegDeleteValueA

  RegDeleteKeyW

  RegDeleteKeyA

  RegSetValueExW

  Exports

  Exports

  _Close

  _CopyKey

  _CopyValue

  _CreateKey

  _DeleteKey

  _DeleteKeyEmpty

  _DeleteValue

  _Find

  _HexToStrA

  _HexToStrW

  _KeyExists

  _MoveKey

  _MoveValue

  _Open

  _Read

  _ReadExtra

  _RestoreKey

  _SaveKey

  _StrToHexA

  _StrToHexW

  _Unload

  _Write

  _WriteExtra

  Sections

  .text

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 322KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R1/$_1_/Uninstall.exe

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  15:90:ab:e2:da:f3:aa:23:18:10:0e:59:41:3a:30:dd

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  18-07-2014 00:00

  Not After

  04-10-2016 23:59

  Subject

  CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  37:ee:e1:b9:39:df:fe:db:a8:4d:5a:bc:a0:a8:c0:d9:23:f9:c5:cd

  Signer

  Actual PE Digest

  37:ee:e1:b9:39:df:fe:db:a8:4d:5a:bc:a0:a8:c0:d9:23:f9:c5:cd

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 458KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 5.9MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 37KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/System.dll

  .dll windows:5 windows x86 arch:x86

  039bcbc605477e8e87ec550c2e60e748

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  GlobalSize

  GetLastError

  lstrcpyW

  lstrcpynW

  GetProcAddress

  WideCharToMultiByte

  lstrcatW

  lstrlenW

  lstrcmpiW

  LoadLibraryW

  GetModuleHandleW

  MultiByteToWideChar

  VirtualAlloc

  VirtualProtect

  FreeLibrary

  user32

  wsprintfW

  ole32

  CLSIDFromString

  StringFromGUID2

  Exports

  Exports

  Alloc

  Call

  Copy

  Free

  Get

  Int64Op

  Store

  StrAlloc

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 963B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/UAC.dll

  .dll windows:4 windows x86 arch:x86

  c4a726be6ec458c19b16bf3893cf4bc1

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SetLastError

  lstrcmpiW

  GetCurrentThreadId

  GetProcAddress

  GetCommandLineW

  UnmapViewOfFile

  WaitForSingleObject

  GetCurrentProcessId

  SetEvent

  GetVersionExW

  SetCurrentDirectoryW

  MapViewOfFile

  Sleep

  OpenProcess

  GetExitCodeProcess

  GetExitCodeThread

  CreateThread

  CreateFileMappingW

  CreateEventW

  lstrlenW

  GlobalAlloc

  CreateProcessW

  GetLastError

  FormatMessageW

  LocalFree

  GlobalFree

  CloseHandle

  GetModuleFileNameW

  lstrcatW

  GetPrivateProfileIntW

  GetPrivateProfileStringW

  DuplicateHandle

  LoadLibraryA

  user32

  SetWindowsHookExW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  PeekMessageW

  MsgWaitForMultipleObjects

  DefWindowProcW

  PostMessageW

  SetForegroundWindow

  CreateWindowExW

  GetWindowThreadProcessId

  CallWindowProcW

  SetWindowPos

  GetWindowRect

  UnhookWindowsHookEx

  GetClassNameW

  CallNextHookEx

  CharNextW

  DialogBoxParamW

  MessageBoxW

  EndDialog

  SetWindowLongW

  LoadImageW

  GetWindowLongW

  EnableWindow

  ShowWindow

  wsprintfW

  LoadStringW

  GetDlgItem

  SendMessageW

  DestroyWindow

  advapi32

  GetUserNameW

  QueryServiceStatus

  CloseServiceHandle

  OpenServiceW

  OpenSCManagerW

  LookupPrivilegeValueW

  GetTokenInformation

  FreeSid

  EqualSid

  AllocateAndInitializeSid

  OpenThreadToken

  AdjustTokenPrivileges

  OpenProcessToken

  shell32

  ShellExecuteExW

  ole32

  CoInitialize

  Exports

  Exports

  _

  Sections

  .text

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 892B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/modern-header.bmp
• $PLUGINSDIR/nsDialogs.dll

  .dll windows:5 windows x86 arch:x86

  9ea5bdc8c90dfcffe309465c26c89758

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  MulDiv

  lstrlenW

  HeapFree

  GetProcessHeap

  lstrcmpiW

  HeapReAlloc

  lstrcpynW

  GetFileAttributesW

  lstrcpyW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  HeapAlloc

  GlobalFree

  user32

  LoadCursorW

  RemovePropW

  DrawFocusRect

  GetPropW

  DrawTextW

  GetWindowTextW

  GetDlgItem

  SetWindowLongW

  SetWindowPos

  CreateDialogParamW

  MapWindowPoints

  GetWindowRect

  SetCursor

  CreateWindowExW

  IsWindow

  SetTimer

  KillTimer

  DispatchMessageW

  TranslateMessage

  GetMessageW

  IsDialogMessageW

  ShowWindow

  wsprintfW

  GetClientRect

  CharPrevW

  CallWindowProcW

  SetPropW

  DestroyWindow

  MapDialogRect

  CharNextW

  SendMessageW

  GetWindowLongW

  gdi32

  SetTextColor

  shell32

  SHGetPathFromIDListW

  SHBrowseForFolderW

  comdlg32

  GetSaveFileNameW

  CommDlgExtendedError

  GetOpenFileNameW

  ole32

  CoTaskMemFree

  Exports

  Exports

  Create

  CreateControl

  CreateItem

  CreateTimer

  GetUserData

  KillTimer

  OnBack

  OnChange

  OnClick

  OnNotify

  SelectFileDialog

  SelectFolderDialog

  SetRTL

  SetUserData

  Show

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 152B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 590B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsExec.dll

  .dll windows:5 windows x86 arch:x86

  8700d0ebbb41c81ea52718af1ab70a93

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcpyW

  MultiByteToWideChar

  lstrlenA

  lstrcmpiW

  lstrlenW

  ExitProcess

  CloseHandle

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessW

  lstrcpynW

  GetCommandLineW

  Sleep

  TerminateProcess

  GlobalReAlloc

  GlobalUnlock

  GlobalSize

  ReadFile

  GetModuleHandleW

  GetTickCount

  GetStartupInfoW

  CreatePipe

  GetVersionExW

  GlobalLock

  DeleteFileW

  lstrcatW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  CreateFileW

  CopyFileW

  GetTempFileNameW

  GlobalFree

  GlobalAlloc

  GetModuleFileNameW

  GetProcAddress

  PeekNamedPipe

  GetCurrentProcess

  user32

  CharPrevW

  CharNextW

  SendMessageW

  FindWindowExW

  wsprintfW

  advapi32

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  Exports

  Exports

  Exec

  ExecToLog

  ExecToStack

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 454B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/registry.dll

  .dll windows:4 windows x86 arch:x86

  421a02aae559045e04759aae146087eb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CloseHandle

  CreateProcessA

  CreateProcessW

  GlobalAlloc

  SearchPathA

  SearchPathW

  GetFileAttributesA

  GetFileAttributesW

  CreateFileA

  CreateFileW

  WriteFile

  WideCharToMultiByte

  GetWindowsDirectoryW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  GlobalFree

  user32

  FindWindowExA

  SetWindowTextA

  SetWindowTextW

  MessageBoxW

  GetDlgItem

  advapi32

  RegQueryValueExA

  RegQueryValueExW

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyExA

  RegCreateKeyExW

  RegEnumValueA

  RegEnumValueW

  RegEnumKeyExA

  RegEnumKeyExW

  RegCloseKey

  RegSetValueExA

  RegDeleteValueW

  RegDeleteValueA

  RegDeleteKeyW

  RegDeleteKeyA

  RegSetValueExW

  Exports

  Exports

  _Close

  _CopyKey

  _CopyValue

  _CreateKey

  _DeleteKey

  _DeleteKeyEmpty

  _DeleteValue

  _Find

  _HexToStrA

  _HexToStrW

  _KeyExists

  _MoveKey

  _MoveValue

  _Open

  _Read

  _ReadExtra

  _RestoreKey

  _SaveKey

  _StrToHexA

  _StrToHexW

  _Unload

  _Write

  _WriteExtra

  Sections

  .text

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 322KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R1/$_1_/apphelp.dll

  .dll windows:5 windows x86 arch:x86

  a67f45b2e1e209d365ca7136c58ff087

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  15:90:ab:e2:da:f3:aa:23:18:10:0e:59:41:3a:30:dd

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  18-07-2014 00:00

  Not After

  04-10-2016 23:59

  Subject

  CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3f:3a:d4:d4:18:70:23:5f:58:82:14:b5:8e:72:65:44:02:40:60:b3

  Signer

  Actual PE Digest

  3f:3a:d4:d4:18:70:23:5f:58:82:14:b5:8e:72:65:44:02:40:60:b3

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  E:\Work\jZip\G1\InstallCore\rbin\apphelp.pdb

  Imports

  wininet

  InternetGetConnectedState

  InternetOpenW

  InternetReadFile

  HttpQueryInfoW

  HttpSendRequestW

  InternetSetOptionW

  HttpOpenRequestW

  InternetConnectW

  InternetCloseHandle

  wtsapi32

  WTSQuerySessionInformationW

  WTSFreeMemory

  WTSQueryUserToken

  kernel32

  Sleep

  CreateThread

  GetExitCodeProcess

  CreateFileW

  DeleteFileW

  FindResourceExW

  GetModuleFileNameW

  InitializeCriticalSection

  InterlockedCompareExchange

  DeleteCriticalSection

  GetVersionExW

  MultiByteToWideChar

  WideCharToMultiByte

  AreFileApisANSI

  ReadFile

  SetEndOfFile

  FlushFileBuffers

  GetFileSize

  UnlockFile

  LockFile

  GetFileAttributesA

  DeleteFileA

  GetFileAttributesW

  LoadLibraryA

  LoadLibraryW

  FreeLibrary

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTime

  GetSystemTimeAsFileTime

  GetTempPathA

  GetTempPathW

  LocalFree

  FormatMessageA

  FormatMessageW

  GetFullPathNameA

  GetFullPathNameW

  GetDiskFreeSpaceA

  GetDiskFreeSpaceW

  CreateFileA

  HeapDestroy

  InitializeCriticalSectionAndSpinCount

  InterlockedPopEntrySList

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  GetTickCount

  GetFileInformationByHandle

  GetCurrentDirectoryW

  DeviceIoControl

  OutputDebugStringW

  CreateWaitableTimerA

  SetWaitableTimer

  SystemTimeToFileTime

  ResumeThread

  TlsSetValue

  ResetEvent

  OpenEventA

  TlsGetValue

  TlsFree

  TlsAlloc

  DecodePointer

  EncodePointer

  GetStringTypeW

  InterlockedIncrement

  ExpandEnvironmentStringsA

  TerminateThread

  GetExitCodeThread

  CreateMutexA

  WaitForMultipleObjects

  ReleaseMutex

  SleepEx

  GetModuleHandleA

  GetLocaleInfoW

  GetSystemInfo

  CreateProcessW

  InterlockedDecrement

  GetLastError

  WaitForSingleObject

  TerminateProcess

  OpenProcess

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  HeapFree

  HeapAlloc

  InterlockedPushEntrySList

  GetProcessHeap

  UnlockFileEx

  WriteFile

  SetFilePointer

  LockFileEx

  GetLocalTime

  GetModuleHandleW

  GetProcAddress

  lstrlenW

  FindFirstFileExA

  InterlockedExchange

  SetEvent

  CreateEventA

  GetPrivateProfileStringW

  WTSGetActiveConsoleSessionId

  CloseHandle

  FlushInstructionCache

  GetCurrentProcess

  SetLastError

  RaiseException

  GetCurrentThreadId

  LeaveCriticalSection

  EnterCriticalSection

  LockResource

  LoadResource

  SizeofResource

  RemoveDirectoryW

  GetDriveTypeW

  FindClose

  GetCurrentThread

  SetThreadPriority

  ReleaseSemaphore

  DuplicateHandle

  CreateSemaphoreA

  LCMapStringW

  GetTimeFormatA

  GetDateFormatA

  CompareStringW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  FindResourceW

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  HeapReAlloc

  HeapSize

  GetCPInfo

  VirtualProtect

  VirtualQuery

  ExitThread

  GetCommandLineA

  RtlUnwind

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  GetDriveTypeA

  GetStdHandle

  ExitProcess

  SetEnvironmentVariableA

  SetStdHandle

  WriteConsoleW

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetConsoleCP

  GetConsoleMode

  HeapCreate

  GetACP

  GetOEMCP

  GetUserDefaultLCID

  PeekNamedPipe

  GetTimeZoneInformation

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetModuleFileNameA

  IsValidCodePage

  user32

  GetSysColor

  DefWindowProcW

  UnregisterClassA

  PostThreadMessageW

  DispatchMessageW

  TranslateMessage

  PostQuitMessage

  GetMessageW

  DestroyWindow

  CreateDialogParamW

  IsWindowVisible

  GetSystemMenu

  EnableMenuItem

  EndDialog

  LoadBitmapW

  DrawTextW

  GetWindow

  MonitorFromWindow

  GetMonitorInfoW

  GetWindowRect

  GetParent

  IsWindow

  MoveWindow

  GetDlgItem

  SetWindowTextW

  SetWindowPos

  DialogBoxParamW

  ShowWindowAsync

  EnumThreadWindows

  GetActiveWindow

  BringWindowToTop

  ShowWindow

  SendMessageW

  ScreenToClient

  FindWindowExW

  PostMessageW

  GetWindowThreadProcessId

  EnumWindows

  CopyRect

  UpdateWindow

  CallWindowProcW

  GetWindowLongW

  SetWindowLongW

  CreateWindowExW

  LoadCursorW

  GetClassInfoExW

  RegisterClassExW

  InvalidateRect

  KillTimer

  SetTimer

  GetClientRect

  EndPaint

  BeginPaint

  MapWindowPoints

  gdi32

  SetBkMode

  BitBlt

  DeleteObject

  CreateRectRgn

  SelectClipRgn

  CreateDIBSection

  GetObjectW

  CreateCompatibleDC

  SetDIBColorTable

  SelectObject

  DeleteDC

  CreateFontW

  advapi32

  RevertToSelf

  ConvertSidToStringSidW

  LookupAccountNameW

  SaferCloseLevel

  SaferComputeTokenFromLevel

  SaferCreateLevel

  RegQueryValueExW

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  ImpersonateLoggedOnUser

  SetTokenInformation

  IsValidSid

  GetLengthSid

  CopySid

  GetSidSubAuthority

  InitializeSid

  GetSidLengthRequired

  CreateProcessAsUserW

  DuplicateTokenEx

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  RegCloseKey

  shell32

  ShellExecuteW

  SHGetFolderPathW

  ole32

  CreateStreamOnHGlobal

  oleaut32

  SysFreeString

  VariantInit

  VariantCopy

  VariantClear

  gdiplus

  GdipCreateBitmapFromFile

  GdipGetImagePixelFormat

  GdipGetImagePaletteSize

  GdipGetImagePalette

  GdipBitmapLockBits

  GdipBitmapUnlockBits

  GdipDrawImageI

  GdipCreateFromHDC

  GdipDrawImagePointRectI

  GdipFillRectangleI

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipDeleteGraphics

  GdipGetImageGraphicsContext

  GdipCreateBitmapFromScan0

  GdipGetImageHeight

  GdipGetImageWidth

  GdiplusStartup

  GdiplusShutdown

  GdipDisposeImage

  GdipCloneImage

  GdipAlloc

  GdipFree

  GdipCreateBitmapFromStream

  msimg32

  AlphaBlend

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  ExpandEnvironmentStringsForUserW

  oleacc

  AccessibleObjectFromWindow

  AccessibleChildren

  ws2_32

  setsockopt

  WSACleanup

  WSAStartup

  ioctlsocket

  __WSAFDIsSet

  getaddrinfo

  freeaddrinfo

  WSASetLastError

  gethostbyname

  socket

  WSAIoctl

  connect

  select

  getsockopt

  htons

  bind

  ntohs

  getsockname

  send

  recv

  WSAGetLastError

  closesocket

  Exports

  Exports

  ApproveFFAddon

  CaptureInstallDialog

  ContinueEncrypt

  ContinueEncryptFromFile

  Expand

  FFAutoEnableExtensions

  FinishEncryptAndSend

  ForcedLaunchApp

  GetAppData

  GetChromeDisabledExtensions

  GetCommonAppData

  GetCommonDesktop

  GetCommonPrograms

  GetCurrentDesktop

  GetCurrentPrograms

  GetLocalAppData

  GetPSExitCode

  GetProgramFiles

  GetTimeInSeconds

  GetUserSid

  HTTPDownload

  HTTPDownloadInSilent

  HideWaitDialog

  HideWindowAndWaitAPN

  IsChromeExtensionOn

  IsProcessAlive

  KillProcessByName

  KillProcessGentlyByName

  LaunchProcess

  LaunchProcessAsyncKill

  MoveShortcuts

  RemovePart

  RestartFF

  RunAsUser2

  RunWithMediumIntegrityLevel

  RunWithMediumPrivilages

  SaveStateFF

  SendByGet

  ShowErrorMessage

  ShowErrorWindow

  ShowErrorWindowTranslated

  ShowWaitDialog

  StartEncrypt

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 211KB - Virtual size: 211KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 55KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 345KB - Virtual size: 345KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 149KB - Virtual size: 148KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R1/$_1_/license.txt
• $R1/$_1_/soffer.dll

  .dll windows:5 windows x86 arch:x86

  ec7f08258a6e85455901e00bbb9a8ccf

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  15:90:ab:e2:da:f3:aa:23:18:10:0e:59:41:3a:30:dd

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  18-07-2014 00:00

  Not After

  04-10-2016 23:59

  Subject

  CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  31:25:b8:c9:51:04:6f:5e:f4:92:d5:61:e7:fd:90:10:08:00:76:48

  Signer

  Actual PE Digest

  31:25:b8:c9:51:04:6f:5e:f4:92:d5:61:e7:fd:90:10:08:00:76:48

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  E:\Work\jZip\G1\InstallCore\rbin\soffer.pdb

  Imports

  kernel32

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  GetCurrentThreadId

  GetModuleFileNameW

  GetLongPathNameW

  GetProcAddress

  GetModuleHandleW

  lstrlenW

  ExpandEnvironmentStringsW

  SetEvent

  DuplicateHandle

  CreateEventW

  GetExitCodeThread

  InterlockedExchange

  WaitForSingleObject

  TerminateThread

  GetTickCount

  WideCharToMultiByte

  MultiByteToWideChar

  OutputDebugStringW

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  MulDiv

  lstrcmpW

  FlushFileBuffers

  GetStringTypeW

  LCMapStringW

  WriteConsoleW

  SetStdHandle

  LoadLibraryW

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  GetConsoleMode

  FindResourceExW

  SetFilePointer

  RtlUnwind

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetModuleFileNameA

  GetStartupInfoW

  GetFileType

  SetHandleCount

  HeapCreate

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetStdHandle

  ExitProcess

  Sleep

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TerminateProcess

  GetCommandLineA

  CreateThread

  ExitThread

  DecodePointer

  EncodePointer

  HeapSize

  HeapReAlloc

  HeapDestroy

  InterlockedPopEntrySList

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  HeapAlloc

  GetProcessHeap

  HeapFree

  InterlockedPushEntrySList

  InterlockedCompareExchange

  LocalFree

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  FlushInstructionCache

  GetCurrentProcess

  WriteFile

  InterlockedIncrement

  CreateFileW

  CloseHandle

  GetTempFileNameW

  GetTempPathW

  DeleteCriticalSection

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  GetConsoleCP

  user32

  MapWindowPoints

  SetTimer

  SendMessageW

  CallWindowProcW

  GetWindowLongW

  SetWindowLongW

  GetClassNameW

  DefWindowProcW

  EnumChildWindows

  GetWindow

  UnregisterClassA

  IsChild

  EndPaint

  BeginPaint

  RegisterWindowMessageW

  SetWindowPos

  GetFocus

  SetFocus

  CharNextW

  RedrawWindow

  CreateAcceleratorTableW

  ClientToScreen

  ScreenToClient

  SetCapture

  ReleaseCapture

  FillRect

  InvalidateRgn

  InvalidateRect

  GetDC

  ReleaseDC

  GetDesktopWindow

  DestroyAcceleratorTable

  GetKeyState

  GetSysColor

  GetSystemMetrics

  PostThreadMessageW

  MsgWaitForMultipleObjects

  PeekMessageW

  MessageBoxW

  IsWindow

  PostQuitMessage

  DispatchMessageW

  TranslateMessage

  GetMessageW

  IsWindowVisible

  SetPropW

  GetSystemMenu

  EnableMenuItem

  CreateWindowExW

  LoadCursorW

  GetClassInfoExW

  RegisterClassExW

  PostMessageW

  DestroyWindow

  CreateDialogParamW

  ShowWindow

  KillTimer

  GetWindowTextLengthW

  GetWindowTextW

  GetDlgItem

  SetWindowTextW

  MoveWindow

  MonitorFromWindow

  GetMonitorInfoW

  GetWindowRect

  GetParent

  GetClientRect

  gdi32

  BitBlt

  DeleteDC

  SelectObject

  GetDeviceCaps

  CreateFontIndirectW

  GetObjectW

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateSolidBrush

  GetStockObject

  DeleteObject

  advapi32

  RegCloseKey

  RegSetValueExW

  RegCreateKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  shell32

  ShellExecuteW

  ole32

  OleInitialize

  CLSIDFromString

  CLSIDFromProgID

  CoGetClassObject

  CreateStreamOnHGlobal

  OleLockRunning

  StringFromGUID2

  CoTaskMemAlloc

  OleUninitialize

  ProgIDFromCLSID

  CoUninitialize

  CoInitialize

  CoCreateInstance

  oleaut32

  VariantInit

  DispCallFunc

  SysAllocStringLen

  VariantClear

  VariantCopy

  OleCreateFontIndirect

  LoadTypeLi

  LoadRegTypeLi

  SysStringLen

  VariantChangeType

  SysAllocString

  SysFreeString

  shlwapi

  PathFileExistsW

  Exports

  Exports

  SOInitialize

  SOShowOfferDialog

  SOUninitialize

  SOWaitAndShowOfferDialog

  Sections

  .text

  Size: 128KB - Virtual size: 128KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 33KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ